TMA-DB2-3.2.2

Turn Off Remote Command Legacy Mode (DB2RCMD_LEGACY_MODE)

MoyenneNiveau 1Automatiséedb2

Description

The DB2RCMD_LEGACY_MODE registry variable determines whether the Db2 Remote Command Service runs with enhanced security or not. It is recommended that legacy mode not be enabled. This registry variable only applies to Db2 Servers running on Windows. Unset or OFF passes. Default: The default value of DB2RCMD_LEGACY_MODE is OFF. Run as the instance owner (or with sqllib/db2profile sourced) so the db2 CLP reads this instance's configuration.

Méthode de vérification

Méthode d'audit: Commande shell

shell

out=$(db2set -all 2>/dev/null) || exit 1; printf '%s\n' "$out" | awk '/^\[[a-zA-Z]\]/ { l = $0; sub(/^\[[a-zA-Z]\] */, "", l); k = l; sub(/=.*/, "", k); v = l; sub(/^[^=]*=/, "", v); gsub(/[ \t]/, "", v); if (!(k in r)) r[k] = v } END { if (!("DB2RCMD_LEGACY_MODE" in r) || toupper(r["DB2RCMD_LEGACY_MODE"]) == "OFF") print "compliant"; else print "noncompliant: " r["DB2RCMD_LEGACY_MODE"] }'

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Run the following command to set the DB2RCMD_LEGACY_MODE registry variable to OFF: db2set DB2RCMD_LEGACY_MODE=OFF

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: db2databaseregistry
Référence: CIS IBM Db2 12.1 Benchmark v1.0.0 - 3.2.2 Turn Off Remote Command Legacy Mode (DB2RCMD_LEGACY_MODE)

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target db2